Today, January 7, 2016, Mozilla announced the immediate availability for download of the Mozilla Thunderbird 38.5.0 email, news and chat client for all supported platforms, including Microsoft Windows, Mac OS X and GNU/Linux.
According to the release notes, Mozilla Thunderbird 38.5.0 is yet another bugfix release that addresses multiple security issues discovered by Mozilla or third-party developers since the previous version of the software, which was announced at the end of November 2015.
Among these, we can mention an integer overflow in the playback of MP4 files on 64-bit builds of Thunderbird, an underflow through code inspection, another integer overflow, this time related to the allocation of huge textures, a cross-site reading attack through view-source URIs, as well as several memory safety issues.
Furthermore, Mozilla Thunderbird 38.5.0 updates the contacts sidebar in the address book manager to remember the last selected address book, and prepares the software to use an SHA-256 signing certificate on Microsoft Windows operating systems, in order to meet Mozilla’s new signing requirement.
Mozilla Thunderbird 38.5.1 out now
In the same day, Mozilla releases a hotfix update for Mozilla Thunderbird 38.5.0, version 38.5.1, which actually adds the necessary changes for the Windows build of the software to use an SHA-256 signing certificate, thus meeting the new add-ons/extension signing requirements implemented by Mozilla in its software products.